Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    android-10_x64
  • resource
    android-x64-20240910-en
  • resource tags

    arch:x64arch:x86image:android-x64-20240910-enlocale:en-usos:android-10-x64system
  • submitted
    16-01-2025 22:04

General

  • Target

    3737642e68d476f63aca2342cb9c5348376654647db1704680278ef876fca602.apk

  • Size

    2.5MB

  • MD5

    ca007f1f13320494a09507a565523e4c

  • SHA1

    9cfaf8606016e4163655a867747690f47e2ad766

  • SHA256

    3737642e68d476f63aca2342cb9c5348376654647db1704680278ef876fca602

  • SHA512

    fd39636063e3c09d8deead0b026d69915be63f1ca369c88b0e7290ad8bfce240503afbfe4b47d9d199ed1f39744a3d774a356dd62e5a0977a107e620f9491940

  • SSDEEP

    49152:pJbupq6Xc4a+FoCi2Mw+c5dRGAVDaJWVo45e2MhzDUay0YHBXhGjbuTvqEkPVqgt:zupqSNaeoCcwxdRGAV28efVjYhmbuTqv

Malware Config

Extracted

Family

octo

C2

https://yenisafakhaberler.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakmansetler.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakgunluk.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksondakika.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakyazarlar.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakgundem.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakekonomi.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakspor.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakdunya.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakmagazin.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksaglik.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksiyaset.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakbilisim.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakyerel.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakaktuel.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakbilgi.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakvizyon.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakteknoloji.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakkultur.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakinsan.xyz/Y2U1NjM1NzFkZTlk/

rc4.plain

Extracted

Family

octo

C2

https://yenisafakhaberler.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakmansetler.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakgunluk.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksondakika.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakyazarlar.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakgundem.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakekonomi.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakspor.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakdunya.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakmagazin.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksaglik.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafaksiyaset.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakbilisim.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakyerel.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakaktuel.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakbilgi.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakvizyon.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakteknoloji.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakkultur.xyz/Y2U1NjM1NzFkZTlk/

https://yenisafakinsan.xyz/Y2U1NjM1NzFkZTlk/

Attributes
  • target_apps

    at.spardat.bcrmobile

    at.spardat.netbanking

    com.bankaustria.android.olb

    com.bmo.mobile

    com.cibc.android.mobi

    com.rbc.mobile.android

    com.scotiabank.mobile

    com.td

    cz.airbank.android

    eu.inmite.prj.kb.mobilbank

    com.bankinter.launcher

    com.kutxabank.android

    com.rsi

    com.tecnocom.cajalaboral

    es.bancopopular.nbmpopular

    es.evobanco.bancamovil

    es.lacaixa.mobile.android.newwapicon

    com.dbs.hk.dbsmbanking

    com.FubonMobileClient

    com.hangseng.rbmobile

    com.MobileTreeApp

    com.mtel.androidbea

    com.scb.breezebanking.hk

    hk.com.hsbc.hsbchkmobilebanking

    com.aff.otpdirekt

    com.ideomobile.hapoalim

    com.infrasofttech.indianBank

    com.mobikwik_new

    com.oxigen.oxigenwallet

    jp.co.aeonbank.android.passbook

AES_key

Signatures

  • Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

  • Octo family
  • Octo payload 1 IoCs
  • Loads dropped Dex/Jar 1 TTPs 1 IoCs

    Runs executable file dropped to the device during analysis.

  • Makes use of the framework's Accessibility service 4 TTPs 2 IoCs

    Retrieves information displayed on the phone screen using AccessibilityService.

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
  • Queries the phone number (MSISDN for GSM devices) 1 TTPs
  • Acquires the wake lock 1 IoCs
  • Makes use of the framework's foreground persistence service 1 TTPs 1 IoCs

    Application may abuse the framework's foreground service to continue running in the foreground.

  • Performs UI accessibility actions on behalf of the user 1 TTPs 4 IoCs

    Application may abuse the accessibility service to prevent their removal.

  • Queries the mobile country code (MCC) 1 TTPs 1 IoCs
  • Reads information about phone network operator. 1 TTPs
  • Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
  • Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs

Processes

  • com.techvision.smartsapp
    1⤵
    • Loads dropped Dex/Jar
    • Makes use of the framework's Accessibility service
    • Acquires the wake lock
    • Makes use of the framework's foreground persistence service
    • Performs UI accessibility actions on behalf of the user
    • Queries the mobile country code (MCC)
    • Registers a broadcast receiver at runtime (usually for listening for system events)
    • Uses Crypto APIs (Might try to encrypt user data)
    PID:5055

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • /data/data/com.techvision.smartsapp/.qcom.techvision.smartsapp

    Filesize

    48B

    MD5

    046a414913add6f5bb60072c7db819b6

    SHA1

    451ee4f6809260aec622d772fd329c7d0297a842

    SHA256

    b66c1320cb063a1d391c94273572ea6edae76c8c8b0a07f8d75c88686f0df72a

    SHA512

    4e6355f3051ed5e811ab030abde1f5be7f5e1cf33be99cd08477e9b6c015deb1d8bd75a09fb9c7176b8511c5ad0a67abc0902a3531e97564ccb6afc57496a47c

  • /data/data/com.techvision.smartsapp/app_rough/aDHGHf.json

    Filesize

    153KB

    MD5

    cec4cef3d0e27efe409c5d92735b06a0

    SHA1

    519a15148fed12c5a01ea157553a5d4eb18a8dc3

    SHA256

    2bec1e6cdcc2228cefc730b3169e1e0ff6e77bdd70643758d42f5a383aefcf53

    SHA512

    8bfaec00c3b24cb75110052d65434837927323ea743e055fcfa80b70ac793d1364aab71155236f6898374ca018a88bc356e89e5363103e35949b460fc15f7d74

  • /data/data/com.techvision.smartsapp/app_rough/aDHGHf.json

    Filesize

    153KB

    MD5

    3059cec32b052627314e4e48fa9cf400

    SHA1

    f188edf0102ec541d81a7f57bbc65ac1029eda1c

    SHA256

    a5dec430e78975d7bf93bb6013c692033ceb084a18046701bd6c373ae57bb2da

    SHA512

    d88e6f6de7459c40faa544ae6fcc2ec5d1e0a07b075fd326b47dab8f3aa69436231e27a4748fcac9ee060a6fbba5161477a96a10141b5ea469788ca834dd4a38

  • /data/data/com.techvision.smartsapp/kl.txt

    Filesize

    230B

    MD5

    c063c7785151dc398e8ed00a410e2b24

    SHA1

    60f920d47d5328c95db1d8c5fbddd52ed7b62e3b

    SHA256

    323d3d9b1c8c81a8e5fe9ae6de3c1da57fd6192ecf5f544e6186156485c34408

    SHA512

    f507a9505ee1ada9b99a10880cb67e87a665652b4e8cc9046c0237bb2fe098cba7e72aca993dd306daf81809c1502e2c309a485daa55f8b67cc3f3b64251f123

  • /data/data/com.techvision.smartsapp/kl.txt

    Filesize

    54B

    MD5

    426dd6461bf5f09822baf2d74a182347

    SHA1

    a9fcc4d37866ce1e1eaf2729e50205ffe64390fe

    SHA256

    c3a3e3319766433ebc21d24e24dbed472b8e5a6f9ac24f1e1f2c0972af7e0a31

    SHA512

    a8ef6ba11da3ef0b9a219d73f3957d37fbd08fde52ad372d49f1e481e4f42709ba968943a7778e092087931475a7f71f87c0681f4c747616180be9bc6c0779a2

  • /data/data/com.techvision.smartsapp/kl.txt

    Filesize

    63B

    MD5

    16428ebec4722dbb66cf965422d28ad4

    SHA1

    5bec8cef44763d49e35045a1e0314d993c4ec8a1

    SHA256

    cf5f9df6c1988d94626076d1750e5efbf0d65cb14163b06babe50957e9e94764

    SHA512

    920f4d19a299fb2a1e92ace3f54ece2825e356d534ca733581a84d44bbfe8c6ea162dcca999541f4643e822628735445f16948314ab6ea2ae60f25a6d4231409

  • /data/data/com.techvision.smartsapp/kl.txt

    Filesize

    45B

    MD5

    23f4f6efb5b92a56f2a1bc25defe09b8

    SHA1

    31e55239a066d7aca67492f9ba32757c6097e4fa

    SHA256

    fe237cdc4d0ff3fc6d097734284a038931e62daeaa0b90987e306869377ebfba

    SHA512

    e3af2e798b35d8dd033956765e2a5d5b61ebe536ff50704f47789741a518e626500b4c07a151b083938c1376e0f0381b7f12ea7fae1113a641501593f67466d0

  • /data/data/com.techvision.smartsapp/kl.txt

    Filesize

    423B

    MD5

    df80656ae9a4c583314a0cf1bfe610b1

    SHA1

    b192ae7c47510594b6b687d935b1e6a978641ca5

    SHA256

    bd952802142d155eeb595e4682c49ee80f6d36f06152b7f79b540acde8194bd9

    SHA512

    1058f9551783678eb6373391e6d826564547793999b8a9dc7d961d40508b3ef603823389eb9214fbde3d8dc6cdd2291ac0e0520a3baab0dc53ba974f336b8d42

  • /data/user/0/com.techvision.smartsapp/app_rough/aDHGHf.json

    Filesize

    450KB

    MD5

    fd73e2c351057b206df49a84b2a4bb42

    SHA1

    a5b3ba88bbb1c7278f9a6fe8d2d4376b606809c4

    SHA256

    aded517d22613e0dc8ad3c8239027623aadb134c51ca9a5a303abb1f4723b0d2

    SHA512

    a1aad9e3fae4bd2c316361cbc147129b447c586f4ad184171f7bc18c242df3a467b29a4faf24155cfcf707191c403f2625aa8e057abd7bdace084f53e01c138e